Offline, air gapped, and limit control at gateways. Is SCADA security really that hard? If it absolutely has to tap into you company’s cloud based SAP, make the interface hardware enforceable supervisory only?